This repository was archived by the owner on Oct 27, 2026. It is now read-only.
Repository navigation
feat(site): optional email on /try (amw-test-signup) - #848
Merged
Merged
Conversation
After a key is shown, one fire and forget POST sends wallet_id, optional email and UTM/referrer to the amw-test-signup function. api_key is never sent. Adds the Supabase origin to /try CSP connect-src, with tests.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4b5663e337
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
PetrefiedThunder
enabled auto-merge (squash)
October 22, 2026 06:10
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow up to #845. Adds an optional email field to /try. After the demo key is displayed, one fire and forget POST goes to the existing Supabase function amw-test-signup with wallet_id, email if given, and UTM/referrer. The api_key is never sent (the function also strips it). Signup failure never blocks the key display. Adds https://cqtlzicxmaklslvxderm.supabase.co to /try CSP connect-src and bumps try asset versions.
Tests: node --test site/test_.mjs (28 passed), pytest tests/test_site.py (88 passed). No live insert was made. Made via Codex CLI on the Mac.
Note
Medium Risk
Introduces client-side collection of optional PII and a new third-party connect target in CSP; signup is best-effort and does not send API keys, but attribution/email handling should stay aligned with privacy expectations.
Overview
Adds an optional email field on
/tryso visitors can opt into updates without blocking demo key issuance.After a test key is shown, the page fires a credential-free POST to the Supabase
amw-test-signupfunction withwallet_id, UTM/referrer attribution, and trimmed email only when it passes a simple format check; invalid email shows a non-blocking status message and is omitted from the payload. Theapi_keyis never included, and signup errors are swallowed so the key UI stays usable.CSP
connect-srcis extended to allowhttps://cqtlzicxmaklslvxderm.supabase.co, with matching site header tests updated. Try page asset versions are bumped (try-2→try-3,try.jstry-1→try-2). Node and Python tests cover signup payload shape, email edge cases, silent signup failure, and new markup.Reviewed by Cursor Bugbot for commit 16211af. Bugbot is set up for automated code reviews on this repo. Configure here.